MITRE ATT&CKsoftware (malware)
S9061 LIGHTRAIL
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2026-09-30
Description
LIGHTRAIL is a tunneler malware. LIGHTRAIL has been known to communicate with C2 SOCKS4A Websocket communications. LIGHTRAIL was first observed in 2022. LIGHTRAIL has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.
Related
Uses · MITRE ATT&CK (7)
Referenced by MITRE ATT&CK · uses (1)
- G1059 NIMBUS MANTICORE group
References
- https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense Mandiant_UNC1549TTPsTools_Nov2025
- https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east Mandiant_UNC1549_Feb2024